Semisol

**Name of the Vulnerable Software and Affected Versions** LNbits versions prior to 0.12.6 **Description** Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) can lead to a payment being considered failed, even though it may still be in flight. This issue can result in a total loss of funds for the node backend. The problem arises when using `blocking: true` on the API call, leading to a timeout error if a payment does not get settled within the 30s timeout. **Recommendations** For versions prior to 0.12.6, update to version 0.12.6 to prevent loss of funds due to unsettled invoices. As a temporary workaround, consider checking the payment status after an error and always assume a payment is still in flight when unsure. Restricting the use of `blocking: true` on API calls until the issue is resolved can also help minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: ScratchOAuth2 (affected versions not specified) Description: The issue allows a third-party site to access and modify a Scratch user's data by pretending to be the user and obtaining a login code from ScratchOAuth2. This is achieved through a series of steps where the third-party site tricks the user into posting a login code on their profile, which the third-party site then uses to complete the login process and gain full access to the user's account. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ScratchVerifier versions prior to commit a603769 **Description** An attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. The exploitation involves the following steps: 1. User starts the login process. 2. Attacker attempts login for the user and is given the same verification code. 3. User comments on the code as part of their normal login. 4. Before the user can, the attacker completes the login process now that the code is commented. 5. The user gets a failed login, and the attacker now has control of the account. This issue primarily affects users who comment on the code and then take several seconds before finishing the login. **Recommendations** For ScratchVerifier versions prior to commit a603769, update to a version that includes the fix, as commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. As a temporary workaround, consider completing the login process as soon as possible after commenting the code to minimize the risk of exploitation. Restrict access to the verification process to trusted users only until the issue is resolved.